Privacy Policy
Last updated: 4 November 2026
In short
- We are a European project and we process your data under the GDPR, Regulation (EU) 2016/679.
- We collect what we need to run your account, your bookings and your reviews, and nothing more.
- We never sell personal data and we run no advertising or cross-site tracking cookies.
- If you accept statistics, we count your visit with our own tool: no cookie, no IP address stored, no third party.
- You can access, correct, export or delete your data at any time, on your own, from your profile.
Manage everything in one place on the privacy choices page.
1. Who we are (data controller)
HosPet.eu ("we", "us") operates a platform for discovering, reviewing and booking pet-friendly stays in Europe. We are the data controller for the personal data described here. Contact for any privacy matter, including the rights in section 8: info@hospet.eu. We have not appointed a Data Protection Officer, as we are not required to under Art. 37 GDPR; the address above reaches the person responsible.
2. What we collect and where it comes from
Almost everything we hold comes from you: what you type into an account, a booking, a review, the newsletter form, a property application or a message to us. The exceptions: your booking status and confirmation come back from our travel partner; property information comes from the property, from its official website and from our suppliers; and the work email we use to contact a property about its listing comes from that property's own public website. We do not buy personal data and we do not build profiles about you.
We do not knowingly collect data from children under 16. We ask for no special category data (Art. 9 GDPR), so please keep health or similar details out of your reviews and messages.
3. Why we process it, on which legal basis, for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and run your account | Name, email, password hash, profile details, pet types | Contract, Art. 6(1)(b) | Until you delete your account |
| Process and manage a booking | Guest name, email, phone, nationality, stay details, booking reference | Contract, Art. 6(1)(b) | Duration of the stay, then up to 10 years where tax or accounting law requires it |
| Take payment and prevent fraud | Payment status, amount, currency (card data never reaches us) | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | As required by accounting law |
| Publish your reviews | Review text, rating, pet details you choose to add, display name | Contract, Art. 6(1)(b); legitimate interest in a trustworthy platform, Art. 6(1)(f) | Until you delete the review or your account |
| Ask for a review after your stay | First name, email, booking reference and the property you stayed at, for bookings made on HosPet | Legitimate interest in collecting genuine reviews from real guests, Art. 6(1)(f); one email per booking, the day after check-out | The date it was sent is kept with the booking |
| Run the HosPet Ambassador programme | Your application (name, email, city, one link and anything you add), then your profile, your personal link, how many visits, sign-ups and bookings it brought, and your discount codes | Pre-contractual steps and contract, Art. 6(1)(b) | The programme closed on 24 October 2026. What it holds stays until you ask us to delete it; an application we turned down is deleted 12 months after our decision |
| Send the newsletter | Email address, subscription date, consent record | Consent, Art. 6(1)(a) | Until you unsubscribe or withdraw consent |
| Answer your messages and partnership enquiries | Name, email, organisation, message | Legitimate interest in replying to you, Art. 6(1)(f) | Up to 24 months after the last message |
| Review a property application and run its listing | Property details, and the name, role, email and phone of the person who applies or manages the listing. To see whether the property can already be booked through our booking partner, we look up its name and city (never your contact details) in Nuitée's hotel catalogue | Pre-contractual steps and contract, Art. 6(1)(b) | While the listing is online, then up to 24 months |
| Run pet experiences hosted on HosPet (hospet.eu/host) | For hosts: your public profile (name, page address, city, bio, photo, website) and the experiences and photos you add; we read them before publishing | Contract, Art. 6(1)(b) | While your experiences are online; a profile and its experiences are deleted when you ask or delete your account |
| Save the trips you plan on HosPet to your account (opening a full trip needs a free account) | The trips you open: city, dates, number of nights, where you start from, your pet (dog or cat, name, breed, weight) and the experiences you add | Contract, Art. 6(1)(b) | Until you delete the trip or your account |
| Keep your pets' profiles in your account (the basics for one pet on the Free plan, the rest with HosPet Pro) and use them in your trips | For each pet you add: name, species, breed, sex, birthday, weight, microchip number and date, rabies vaccine dates, pet passport number, your vet's name and phone, and your notes; you can change or delete them at any time | Contract, Art. 6(1)(b) | Until you delete the pet or your account |
| Share a pet's hotel card with a stay, when you choose to (HosPet Pro) | The pet's details above and your first name, shown to anyone who has the private link you create; we keep only a fingerprint of the link, not the link itself | Contract, Art. 6(1)(b) | The link works for 7 days, or until you stop it, make a new one or Pro ends |
| Cards you save from the trip chat to your Notes | What you chose to save: the name, place, date and time of each suggestion, the city and your pet's first name. Each card is a page anyone with its link can open (not shown to search engines) | Contract, Art. 6(1)(b) | Until you delete your account |
| Your HosPet Pro free trial | The date your 7-day free trial ends, so each account has it once | Contract, Art. 6(1)(b) | Until you delete your account |
| Ask you once how a trip you planned went, so we can improve it | Your name and email and the trip it is about; one email, never a newsletter, and you can tell us not to write again from that email | Legitimate interest in improving the service, Art. 6(1)(f); you can object at any time | Until you object or delete your account |
| Pass your request for a pet experience to its host | Name, email, preferred date, number of people, your pet and your message, sent by email to the host so they can answer you directly | Consent, Art. 6(1)(a), given with the box on the request form; steps before an agreement, Art. 6(1)(b) | Up to 24 months after the request; the host keeps the email they received |
| Introduce your property to our booking partner Nuitée, only if you tick that box when applying | The application you submitted: property details, contact name, role, email, phone, website | Consent, Art. 6(1)(a), which you can withdraw at any time | We keep the record of your choice with the application; Nuitée keeps what it receives under its own privacy policy |
| Contact properties about their listing on HosPet | Business contact details (property name, work email) taken from the property's own public website | Legitimate interest in keeping listings accurate and complete, Art. 6(1)(f) | While the listing is online. If you ask us to stop, we keep only the address and date on a do-not-contact list so we never write again |
| Read and answer what properties write to partners@inbox.hospet.eu | Name, work email, the message and any files attached. An AI assistant reads the messages to summarise them and draft a reply; a person reviews every reply before it is sent, and nothing is decided automatically | Legitimate interest in running listings with the properties, Art. 6(1)(f), or steps before an agreement, Art. 6(1)(b) | While the property is listed or the conversation is open, then up to 24 months after the last message |
| Publish the travel stories you share on hospet.eu/ideas, and count "me too" votes | The Instagram or Threads username and the story you write, published with links to those profiles and the flag of your country (taken from your connection; only the country is kept), only after we check them and only because you tick the box. For votes: an identifier made from your IP address and browser that cannot be turned back into either; your browser also remembers which ideas you voted for | Consent, Art. 6(1)(a), for publishing (you can ask us to remove your story at any time); legitimate interest, Art. 6(1)(f), for one vote per person | Published stories stay while the page is online or until you ask us to remove them. Stories we do not publish: 12 months after our decision |
| Answer your questions in the trip chat, only if you start it | What you type in the chat and the answers it gives. Your browser keeps a random identifier so the conversation can continue. Nothing reaches the chat provider until you press "Start the chat" | Consent, Art. 6(1)(a), given when you press "Start the chat"; the transfer to the US relies on your explicit consent, Art. 49(1)(a) | Kept by Noodle Seed for up to 30 days, during which we can read the conversations to improve the answers |
| Keep the site secure and prevent abuse | IP address, request metadata, rate-limit counters, the result of the sign-up security check (a small calculation your browser solves on our own server, no third party) | Legitimate interest in security, Art. 6(1)(f) | Up to 12 months |
| Prove that you consented, and to what | Consent type, date, document version, source, IP and browser | Legal obligation to demonstrate consent, Art. 7(1) and 5(2) | 5 years after the consent is withdrawn |
| Count how AI assistants use the HosPet connector (hospet.eu/mcp) | Which tool was called, the name of the assistant app, the country of the server that made the call, and an anonymous identifier that changes every day. The call comes from the assistant provider's servers, not from your device; the IP address is used only to derive the country and that identifier and is never stored. Your questions to the assistant are not sent to us, only the search it makes (for example a city name) | Legitimate interest, Art. 6(1)(f): knowing whether the connector is used and keeping it working | Up to 25 months, then deleted automatically |
| Understand how the site is used | Pages viewed, time on page, country, device type, browser and operating system family, the website you came from, the campaign tags of the link you followed (for example which social post), and an anonymous identifier that changes every day. Counted by our own tool, without a cookie; your IP address is used only to derive the country and that identifier and is never stored | Consent, Art. 6(1)(a), via the cookie banner ("Accept all"). Not counted if you decline, or if your browser sends Do Not Track or Global Privacy Control | Up to 25 months, then deleted automatically |
Where we rely on legitimate interest we have weighed it against your rights and you can object at any time (section 8). Where we rely on consent you can withdraw it at any time, and withdrawing is as easy as giving it; withdrawal does not affect processing already carried out.
4. Who we share it with
Only with the parties below, each bound by a data processing agreement under Art. 28 GDPR or acting as an independent controller for its own service. We do not sell personal data and we do not share it for advertising.
| Recipient | Role | Location |
|---|---|---|
| Nuitée / LiteAPI | Booking fulfilment: passes the guest details the hotel needs to hold your room. For properties, receives your application only if you ask to be introduced to them | EU and third countries under SCCs |
| The property you book | Provides the accommodation and applies its own pet policy | Country of the property |
| Stripe | Payment processing and fraud prevention. Card data is entered in their portal and never reaches our servers | EU / US, SCCs and their own certifications |
| Resend | Transactional email and newsletter delivery, and the mailbox where properties write to us (partners@inbox.hospet.eu) | EU / US, SCCs |
| Anthropic (Claude) | AI assistant that reads messages sent to partners@inbox.hospet.eu to summarise them and draft replies, which a person reviews before sending | US, SCCs |
| Noodle Seed (TheNoodleSeed Corporation) | Runs the trip chat, only if you start it: receives what you type and passes it to the AI provider it uses to write the answers | US, on your explicit consent before the chat starts, Art. 49(1)(a) |
| InsForge (database and storage) and Fly.io (hosting) | Run the platform infrastructure on our behalf | EU regions where available, SCCs otherwise |
| Only if you choose "Sign in with Google": confirms who you are and shares your name, email address and profile picture with us | EU / US, EU-US Data Privacy Framework and SCCs | |
| IONOS | Hosts the hospet.eu domain and receives what you send to our hospet.eu addresses (such as info@hospet.eu), forwarding it to our mailbox at Proton | EU |
| Proton | Hosts the mailbox that receives your messages to us, and our weekly off-site backup (Proton Drive) | Switzerland (adequacy decision) |
| GetYourGuide | Only if you click one of our activity links, which carry an affiliate identifier and no personal data | EU |
We may also disclose data where the law obliges us to, for example to a competent authority acting within its powers.
5. Transfers outside the EEA
We keep data in the EEA wherever the provider offers it. When a provider processes data in a third country, the transfer relies on an adequacy decision under Art. 45 GDPR or on the European Commission's Standard Contractual Clauses under Art. 46, with supplementary measures where needed. If you book a property outside the EEA, your booking details necessarily travel to that property so it can host you, under Art. 49(1)(b). The trip chat is run by a US provider that does not offer these safeguards, so it only starts after you read where your messages go and press "Start the chat": that is your explicit consent under Art. 49(1)(a), and you can simply not use the chat.
6. Cookies
We use strictly necessary cookies to run the site, and optional ones only with your consent. The full list, the lifetimes and the way to change your mind are in the Cookie Policy.
7. How we protect it
Traffic is encrypted in transit (HTTPS with HSTS), passwords are stored hashed and never in clear text, database access is locked down row by row, admin areas require authentication, and sensitive operations are rate-limited. Access to production data is limited to the people who need it. If a breach ever puts your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay, as Art. 33 and 34 GDPR require.
8. Your rights
- Access (Art. 15): a copy of the data we hold about you.
- Rectification (Art. 16): correct anything inaccurate, directly in your profile.
- Erasure (Art. 17): delete your account and data from your profile, in two clicks and an email confirmation. Former Ambassadors can write to info@hospet.eu and we delete their profile, photo, articles, points, codes and link results. Deleted data then leaves our backups as they rotate: within 7 days from the platform's nightly backups and within 8 weeks from our weekly off-site copy. Booking records we must keep by law stay for the period shown above.
- Restriction (Art. 18) and objection (Art. 21), including to any processing based on legitimate interest.
- Portability (Art. 20): your data in a structured, machine-readable format.
- Withdraw consent (Art. 7(3)) for the newsletter, usage statistics, member-link credit or the introduction to Nuitée, at any time.
- No automated decision-making: we run none of the profiling or automated decisions described in Art. 22.
Write to info@hospet.eu and we answer within one month (Art. 12(3)), extendable by two months for complex requests, which we would tell you about. Exercising your rights is free. You also have the right to lodge a complaint with the data protection authority of your country of residence, workplace or of the alleged infringement (Art. 77).
9. Changes to this policy
We may update this policy when we add or change a feature, when a partner changes how it works, or when the law changes. We publish the new version here with its date, and for anything material we tell you before the change takes effect, by email or a notice on the site. Where a change needs your consent, we ask for it again.